Privacy Notice

At Formix (the "Data Fiduciary"), we respect your privacy and are committed to protecting your personal data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023 of India. This notice explains what data we collect, why we collect it, how long we retain it, and your rights as a Data Principal.

1. Personal Data We Collect

We collect personal data only when strictly necessary for providing our services. This includes:

• Account Data: Name, email address, profile image, and authentication logs (via BetterAuth).
• Contact Data: Information provided when submitting support or inquiry forms.
• Service Data: API tokens, Webhook URLs, and configuration data needed to integrate third-party services (e.g., Slack, Zapier, Meta).
• Form Submissions: We process and store data submitted via your Formix forms on your behalf. Note: You remain the primary Data Fiduciary for your end-users' data.

2. Purpose of Collection

Your data is processed strictly for the following purposes based on your explicit consent:

• To provide, secure, and maintain the Formix headless API infrastructure.
• To route form submissions to your designated integrations.
• To process billing and subscriptions (via Dodo Payments).
• To communicate service updates, security alerts, and promotional offers (only if explicitly opted-in).

3. Third-Party Data Processors

We share minimal necessary data with verified third-party processors to run Formix. These include:

• Database & Storage: Neon PostgreSQL, UploadThing.
• Authentication & Payments: BetterAuth, Dodo Payments.
• Analytics & Security: Upstash Redis (rate limiting), PostHog, Vercel Analytics (only with your cookie consent).
• Communication: Resend (transactional emails).
• AI Processing: Groq AI (Only form schemas are sent; end-user submission data is NEVER sent to AI models).

4. Data Retention

We retain your personal data only as long as necessary to fulfill the purpose for which it was collected. If you request account deletion, your Account Data and Form Submissions are permanently erased from our active databases within 30 days. Backup logs are purged within 90 days.

5. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights regarding your personal data:

• Right to Access: Request a summary of personal data we process about you.
• Right to Correction & Erasure: Request correction of inaccurate data or deletion of your data when it is no longer required. (Account deletion can be done directly from the dashboard).
• Right to Withdraw Consent: Withdraw your consent for non-essential processing (e.g., marketing emails, analytics trackers) at any time via your dashboard settings.
• Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.

6. Grievance Redressal

If you have any concerns regarding how your data is handled, wish to exercise your rights, or want to report a data breach, please contact our designated Grievance Officer: